fix(server): make Workspace sessions work against a cookie-gated dashboard

[SherubabaFBC]

Problem

On remote deployments (Docker / Tailscale) the Hermes dashboard runs behind interactive cookie login. Workspace's dashboard.available capability comes from the public /api/status probe, so it's true even when the dashboard's session APIs are cookie-gated. All eight session adapters route dashboard-first on that flag, so the Sessions tab fails with:

401 {"error":"unauthenticated","reason":"no_cookie"}

The fork's only dashboard-auth path was the inline session-token scrape, which upstream Hermes removed — so it always yields nothing. Separately, the gateway fallback returned resp.items for the OpenAI-compatible {object:"list", data:[...]} shape, crashing callers with Cannot read properties of undefined (reading 'map').

Fix

• Split dashboard.available (reachable) from dashboard.authenticated — the latter probed against GET /api/sessions?limit=1 through dashboardFetch. Dashboard-backed composites (sessions/skills/config/jobs, mcpFallback) now require authenticated, with the legacy gateway probes as fallback.
• Cookie login (dashboardLogin()): authenticate via the built-in basic provider — POST /auth/password-login -> session cookie — reused and refreshed on 401, with a failure cooldown to avoid lockout. Credentials via HERMES_DASHBOARD_USERNAME / HERMES_DASHBOARD_PASSWORD; unset preserves the legacy behavior.
• DashboardAuthError (typed) on 401/403; sessionCall() routes dashboard-first only when authenticated, degrades via markDashboardUnauthenticated() on a mid-flight 401 and falls back to the gateway; asArray() normalizes sessions/items/data so list adapters never return undefined. Applied to all eight session adapters.

Not in scope

~50 other dashboard.available consumers in src/routes/api/* share the reachable-vs-usable assumption; left unchanged here to keep the diff focused — they behave exactly as before.

Testing

• npx tsc --noEmit: adds 0 new errors (identical count with and without this change).
• vitest: 34 tests covering the split, cookie login (success/reuse/reject), gateway fallback, and shape normalization — all pass.
• Verified end-to-end on a live cookie-gated dashboard deployment: sessions, skills, config, and jobs load with the dashboard's auth gate left intact.